Traefik CVE-2026-114656

Exploitation requires a Traefik deployment (versions before 2.11.58 or 3.7.13) that both enforces mutual TLS using the RequireAndVerifyClientCert clientAuthType AND defines a router rule containing a negated Host matcher (!Host()). The negated matcher is incorrectly counted as a served domain, producing a TLS options conflict that silently falls back to the default TLS options which omit client-certificate verification. Limiting factors: this is a non-default routing configuration (reflected as AT:P in the CVSS 4.0 vector), so deployments without !Host() rules or without client-certificate enforcement are not affected; no user interaction or attacker authentication is needed once the vulnerable configuration exists.

This is a moderate-severity mTLS authentication bypass (CWE-436, Interpretation Conflict) in Traefik, reported by VulnCheck and confirmed via a Traefik GitHub Security Advisory (GHSA-2272-4vv8-65ww). The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated attack but explicitly flags AT:P - a non-default attack requirement - which aligns with the description's precondition that a router rule using !Host() must create a TLS options conflict that falls back to default options. Impact is modeled entirely on the subsequent system (SC:H/SI:L), i.e. the backend protected by RequireAndVerifyClientCert, not Traefik itself (VC:N/VI:N/VA:N) - consistent with a bypass that exposes a protected service rather than compromising the proxy. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or widespread automated attacks; this reads as a real but conditional priority - serious for the specific deployments that use negated Host matchers alongside client-certificate enforcement, and low-urgency for the majority running default or standard configurations. The AT:P/config-dependent nature is the dominant limiting factor and should drive prioritization over the raw 6.9 score.

An organization fronts an internal service with Traefik and enforces mutual TLS via RequireAndVerifyClientCert, but a router also defines a rule using a negated Host matcher (!Host()); because negated matchers are miscounted as served domains, a TLS options conflict causes a fallback to the default options that skip client-certificate verification. An attacker with no client certificate connects over the network and reaches the protected backend as if authenticated. No public exploit was identified at time of analysis, so exploitation would currently require an attacker to independently discover the vulnerable !Host() configuration.